PT-2026-128132

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do tcp getsockoptTCP CONGESTION do tcp getsockopt reads icsk-icsk ca ops-name without holding rcu read lock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcp congestion ops in bpf", icsk ca ops can poin...

PT-2026-128131

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do tcp getsockoptTCP CC INFO do tcp getsockopt reads icsk-icsk ca ops and dereferences the get info function pointer without rcu read lock. With BPF struct ops congestion control, ca ops can point to...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.30 contains security vulnerabilities. These vulnerabilities stem from the RFCOMMCONNINFO getsockopt handler, which accepts unconnected sockets when enabled with a delay. After the session is cleared, it still derefreshes empty pointers, potentially leading to kernel...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fixed the locking mechanism in .getsockopt. The functions iucvsocksetsockopt and iucvsocksetsobrowsable were mirrored, and the entire switch statement was wrapped within locksock/releasesock. The existing lock that only...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfc: llcp: Reading llcpsock-local under the socket lock in getsockopt. nfcllcpgetsockopt reads llcpsock-local before locksocksk, and then dereferenced the cached pointer within the locked region. llcpsock.bind assigns and clea...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15

In net/tls/tlsmain.c within the Linux kernel up to version 6.2.6, dotlsgetsockopt lacks a locksock call, resulting in a race condition which can lead to use-after-free or NULL pointer dereferencing...

Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

Astra Linux – vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller’s buffer using mint, but then stores the value via putuserval, int user optval, which always writes sizeofint bytes...

CVE-2026-90157

A flaw was found in the Linux kernel. A local attacker could exploit a vulnerability in the BPF Berkeley Packet Filter cgroup getsockopt hook. By providing a negative length value, a malicious BPF program could cause the kernel's memory copy function to process an invalid size. This could lead to...

CVE-2026-90093

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. This vulnerability allows for a Use-After-Free UAF condition when handling getsockopt and setsockopt operations. An attacker could exploit this by causing the system to attempt to access...

PT-2026-106575

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Bluetooth subsystem. The hci dev close sync function clears the hdev-local codecs list after releasing the hdev-lock. Because the sco sock...

PT-2026-115823

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Serialize local codec list cleanup hci dev close sync clears hdev-local codecs after releasing hdev-lock. Codec list additions and both traversals in sco sock getsockopt use that lock, but the close path does...

SUSE CVE-2026-97476

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

DEBIAN-CVE-2026-97476

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

AZL-103778 CVE-2026-97476 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

CVE-2026-97476

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

UBUNTU-CVE-2026-97476

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

EUVD-2026-86074

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

CVE-2026-97476 rds: filter RDS_INFO_* getsockopt by caller's netns

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

CVE-2026-97476 rds: filter RDS_INFO_* getsockopt by caller's netns

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...